Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,32 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-08-25 — A terminal goes over a route you choose `api 0.91.0` `web 0.118.0`
+
+**Opening a shell used to mean opening it through the Jarvis agent, from the Agents page.** A Linux
+host commonly answers on OpenSSH _and_ through an enrolled agent, and those are different networks,
+different credentials and different accounts at the other end — so which one your shell goes over is
+a decision. Until now it was made for you by whichever was available.
+
+You can now open a terminal from the **Assets** list as well, and pick the route by name. A machine
+with one way in opens straight away; one with several offers an entry per route. The choice is made
+before the shell opens, and it is recorded — on the session, in the audit trail, and in
+**Settings → Organization → Terminal sessions**, which now shows which route each session used.
+
+**SSH sessions are held to exactly the same rules as agent ones.** The same idle timeout, the same
+four-hour ceiling, the same output limit, the same recording under `VAULT_MASTER_KEY` and the same
+retention policy. A different route is not a different set of rules.
+
+**What decides who may do this has not changed.** The per-machine "may open a terminal" permission is
+the same one, and it still has no bearing on what the assistant may do on those machines. What it
+now permits is a shell by any route that machine has, and the access editor says so where you grant
+it.
+
+### Fixed
+
+- The agents list offered a terminal on a machine whose agent had no route recorded, which could
+  never open. It now says why instead.
+
 ## 2026-08-25 — Settled approval requests fold away `web 0.117.0`
 
 **A conversation with several approvals behind it was a wall of text.** Each settled request kept its